Wireshark-dev: Re: [Wireshark-dev] GTP session plugin
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Wed, 11 Nov 2015 13:13:21 -0500
On 11/11/15 07:36, POZUELO Gloria (BCS/PSD) wrote:

Hi,

I’ve almost finished the plugin I’m working on, but now I’m trying to
improve the performance. I’d like to ask you if there’s a way to know if
wireshark has dissected all packets of the pcap file, this way I could
avoid to calculate all the necessary things for getting the GTP session
every time I sort the pcap, for example. Now, what I’ve done, is that
every packet checks if it has a session ID or not, but for that, we have
to loop over all the existing sessions and if the pcap is bigger enough,
then the performance is not as good as expected. I think that knowing
when the first calculus has finished will improve the performance, since
we only have to show the corresponding session ID.
Hmm, there must be a better way. For example, can you store, for each packet, which session it belongs to (i.e., trade memory usage for time)?